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application program residjng on a server computer sys- 
tem A probe program residing at the client computer 
generates requests for the services of the application 
program and records transaction records based upon 
service responses therefrom The requests and trans- 
action record generation is controlled by a set of probe 
configuration information at the client computer. Trans- 
action records are provided to a central repository 
whereat statistical information is pre-processed and in- 
serted into statistics tables. A display system enabjas a 
computer' user to Interactively request and, view a plu- 
rality of displays. or data sets- of the monitoring data. 
Each data set includes data elements )tir\icr\ may be In- 
teractively Indicated by ihe viewer to cause Che reirreval , 
and display of relatep* data sets having data elements 
associated with those irr the original display. 
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Description ! 
Ftefd of tj^ejnygnftfbji 

5 [OOOi) The present invention fe goodly related to the field of network system service, and particularly to an end- 
user based application availability and response monitoring and alerting system, method and program product Wore, 
specifically, the present invention enable© the monitoring of availability and response time or other desired performance 
metrics of an application program from the perspective of an end-uG or Utilizing the application program over a distributed 
computing network. Additionally, the Invention provides a readily accessible ■feportirtg-syetem for dynamically commu- 

io nicating ihe real-lime result© of trie application program rrrorwtorjng The monitoring system is implemented such that 
ll is not platform specific, does not Impact the perfprmance- of the monitored applications/ and permite easy maiote- 
■ nance, The reporting system enables real-time analysis of .the monitoring results, via grapnical.drsplay at a variety of 
levels cA granularity available to any userof the networkfrbfin ,a central repository thereon; Additionally me invention 
includes facilities for astablishmo. performance thresholds for the application program and for determining whan ihe 

i* established thresholds havebeen violated which may jhdicate perforrnance.aberrations of the pfogram. The in von Hon 
' further provides alert signals indicative 'of the threshold vfoJat/On lo a sendee or support entity so as to quickly provide 
the appropriate services to the poorly functioning application 

E acKqrourjd oi pre Invention 

[0OO2] The pervasive current trend in data processing system design is toward utilization of a distributed computing 
environment where In an end-user accesses application programs and data over one or more interconnected networks 
each fncludfng multiple interconnected computers, in a typical distributed computing environment, the desktop com- 
puters or network computers used by the end-user community) are connected as cfterrfs over local area networks 
23 (LANs) to a server, which io turn may connect to other such servers Ideally or remotefy. For example, a business 
enterpnse may maintain several interconnected LANs at each of Its geographically separate offices. LAM servers at a 
given office are each interconnected with one another and are further interconnected override area networks (WANs) 
lo the servers in ihe networks of the remote offices. . 

[0003] Businesses have increaslnglyadopted this computing m'odel in order to allay the cost Of operating, maintaining 
30 and upgrading separate isolated "piece-part" computing systems The Interconnected networks characterizing this 
distributed computing, model facilitate the prioritization of applications and data, with mresiorvcrrtical applications and 
data residing on h'gh-«nd, high-bandwidth servers, and less tm porta nt applications and data assigned to correspond- 
ingly lower-end servers. In addition, such a hlghry distributed processing model will typically incorporate features which 
ertsure that the system will continue to function properly and will be continuously available* notwithstanding the failure 
35 or maintenance of a single or even multiple servers, 

[0004] Implementation of 6uch a complex, distributed computing model, while offenng numerous advantages for Its 
users, present correspondingly complex network management problems for its network administrators. Heterogene- 
ous operating systems may be Implemented in the interconnected networks. Different applications may be running on 
separate servers as well as p*/ff erent versions or* ret eases of the sam« application . Failures occurring over ■localized or 
*0 distributed portions of the network are not uniformly reported and accordingly corrective actions may pe substantially 
delayer!. ' 

[0005] In many instances an information teotirtofogy services (IT) organization either wfthih or outside of the enter- 
prise Is charged with the responsibility for managing the distributed computing ernifohment Typically, a.servtcG level 
agreement (SLA J wilh such an agency $pecffies an expected level of application availability and response time fpr the 
*s users of such.a network. Adherence to these expected baseline; levels is, required tafufjfil contractuai obligations and 
the failure to achieve these baselines maytf irectiy r esUlt In the los£ of a customers bushes$. Accordingly an application 
monitoring system which provides reaf-tlme data regarding application avanaollity and .response lime would be an 
invaluable asset to such an organization. . ■ 

[0006] A number of network management tools have be-sn developed to assist the network manager in monitoring 
50 the performance, of a distributed computing system. For example', the product known as System Performance Monitor/ 
2 available from I ntemationer Business Machines Corp6ratiori (hereinafter *IBM"), provides a graphical interface for 
depicting the performance" of various hardware resources in a proceeding system, however this product doos not in- 
dicate the availability and response of a software application to an end-user, ahd does not permit in depth apajysis of 
the resuHts of the morrjtdring data. The I BM Netfinfty Manager eofrware provides network monitoring of server resources 
56 as well as operaiing system resources at the client level, however it also subsists at the server level and does not 
monitor drent-based access to application programs (Netfinrty is;a trademark of IBM Corporation). Accordingly, jt does 
not provide the IT professional wilh information needed to assess whether the aforementioned baseline levels, many 
of which are specified from the perspective of an end-U6er or client of the network, are being achieved. 
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[00071 • A number ot passive monitoring systems ex«t for gathering avertable data from servers and/or ci.ents ,n a 
^I^TLwise rha U S patent no. 5.483,468 to Ch en 0 1st. for -System and Method For Concurrent Racing 

tooiT SLten^ systems disclose mechanism* for ind.pcnden.iy ^^^<f" ifldi ^° °' 
L,r.i« the distributed computing system and collecting and reporting the generated .nformation. 

[00121 U S. P*J^ . * OJK f ralj on of a computer network by modifying an application program to 

lZTJTe^T^:^TJ:Z^ e the cSrrcnco of. moni.onedevente to an -nt P= ng 
' I-hZ rafeance with a flexible ruffe base in the eventlprocessino machine which associates the occurrence of 

rr—r ^ 

rnrLifr, in ih*» evstem to report on ore-determined events occurring during the execution thereof. 
™Z u?3K£ 353 E Bonne.1 et al for "System For Monftormg And Managing <^»Mk« 
S aU-~£""» ^ Distributed Computing Environment Using An iMpM it A MM 

' Sw«' system for managing applications and other eerver resources wherein an agent 'sjnstalted m eachcrfihe 
eS ^™ute«d r^ netS The installed agents carry out the Interrogate functions for Identifying which system 
fheTrS on what resources are available and tor monitoring aspects of resources and applicants preeem on the 
SeX^rZSte wrth manager software systems on the network to enable a 
■ rtuXv d^icrina all resources and applications present throughout the network and the current state thereof. 

us Stent ^TSaTsS to Chang for 'System And MethodFor Selectively And Contemporaneous^ Mon- 
ffipiSffiAMSEoo«25Sr teache* a monitoring W information regarding the status 

• adm^etrator The server process-monitor program proyldeainf ormatioh to the netwo.rk administrator at the granulanty 

STeerva^ ^^e^^S^Sorn pf°9™T. running oh the server as In SKagerJ.ng or running on the eewer .n • 
aT P rn£moda» collect Information Err? monftorad applications running thereon In antler case the r 
. .SSS^-n-W. as to the experience of the client-since the intorrnatlon is he,ng ^ed^d glared on 

The se.var side of the network rather than the clieni side. Moreover, the addition of tfw ™«nonng 
so n£n7a in the network creates the same maintenance problems as, and may 8| mply be thought of, as adding yet 
^! I latoianto each of the serverc Furthermore, the execution of these monitoring programs may aubatanttsiiy 
Z^^^TfZ^!^. and tn turn the networks tbatthey ^^J^S!^ 
. , ttS h the nLe of effic.cnUy managing the network the very tool being need to achieve that objects creates an 

££" !^ foregotng it can be seen the, a new app W monitoring system which generates 
SSLe S WormaL or any plher desired application program metrics from the perapectare ot acllen wouto be 
oTSat va^a to a network adrmn-strator, The system should ba designed to be 'mplamantec ^J£^£j2l 
wrthin a complex dtetnbuted competing environment at which a dlentcomputersystemmaybe coupled. ^ the function 
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of the probe shoufd haye negligible impact on the performance of the network, The system shdu.ld be customizable? to 
provide real lirne alert signals alerting a recipient of the traversal of user-defined thresholds .such as a maximum toi- 
< enable response* time or minimum availability of a rtronitored application program: 

[0017] The monitoring system should provide dynamic reports on. for example, application program availability and 
b i esponse time, which can bo iailored by the observer to display in graphical or tabular form the real-lime and archived 
monlrarirtfl information relevant to the particular observer The reports should be displayed in such a manner that the 
.'viewer may display either via a graph or table or otherwise data relating to the performance of many servers' and/or 
applications and should provide an interactive facility "for enabling the viewer to "drHkfdwn" to view data on specific 
servers or applications and/or to drill .up therefrom to a broader view of the- performance data: 
10 [0018) The performance repoa should be readily ava Jlableto anyone with ariy type pf access tpth^narworK and the ' , 
data therein should reside on a central repository on the network which includes relevant pre-processed slatrstfcal 
infqrmatidn related to the 6tored data. Access to this information should be provided forepersons Including the network 
administrator, herjb-desk, and end users of Ihe network applications, via wired or wireless connections to the network. 
• [001 0J Finally, the system should be easily implemented and maintained so ae to serve as* an old rather than a further 
is burden to the 1 network manager. 

Dtectogurg of the Invention 

[0020] The foregoing problems and shortcorrtngs of the prior an are overcome and further advantageous features 
to are provided bv the prepertf inversion wherein a mclhod. anr>ar.3tfJP and program product for 'mntarnon^pn p rifer 7 f- 
based application program monitor in a dismbuied computing environment is described Advantageously the present 
invention prsssnts techniques for monitorjng, reporting and for generating performance-based alert signals, based 
upon the performance of application services from an application program residing on a server computer coupled to 
a client computer system in a distributed computing environment, 
25 [0021] ' tn an embodiment of the invention, a computer network Include? a server computer having an application 
program which provides application services to a* coupied client compuier system wherein the cifent computet system 
recofds Information related to the performance of the services of the application prop/am via en application probe 
software residing on ihe client computer. 

[O022] A set of parameters or probe configuration information are established at the client computer system for use 
oo in recorrfing'lhe performance of the a pp Realtor! program The client computer probe is configured in accordance wrth 
' these parameters to send service requesls to the server computer to request the performance of the application services, 
by the applroatioh program. 

[0023] Correspondingly, ths server computer generates a service response whrch may be an indication that. the 
request Is being serviced (a successful response), or which may indicate that the request was rejected (an unsuccessful 
38 response), or aftemativeiy, the response may fn fact equate to no response from the server system for a pre-defined 
timeout period (an unsuccessful response). 

[0024] Based upon the response that has been received, a transaction record including information related to the 
performance of the application services by the application program is generated at the client computer. 
[0025] Finally, the request and response cycle is repeated in accordance with the parameters supplied to the client 
40 computer system. 

[0026) In an embodiment loi the invention tnese parameters may Include such jhfofmatfon as the name of the appli- 
cation program, the address of the server system, the frequency of access to the server, computer, the schedule of 
avaflabilrty of the Application program and threshold information such as. minimum avalfabfffty fevefe and maximum 
resfwnsG time levels as well as the duration of the time out interval for non-respondrnp appllcaifon programs' and 

4S whether and how often to retry requests resulting in unsuccessful responses, other'fiiu3i native prpbe corifigurairdn 
Information may include the designations of remote centralized repositories for forwarding the generated transaction 
records, as wolf as indications as to whether to dlscontinue the Application monitoring during 4 scheduled periods In 
.which the application program is not ava ilabfe or altemati va Jy to otherwise indicate in the generated transaction records 
, ' these scheduled periods. . " 

[0627] fn a, further embodimcnf of the invention the exceeding of such defined thresholds will cause the client com- 
puter to generate and alert signal which may bo received and acted upon by service entities td provide problem reme- 
diation for the associated application program. 

In ah embodiment of fhe invention the service request ie a request to provide a file to the client computer, tn 
, a preferred embodiment wherein the service request re a request to perform services far which no client authentication 

SS is required. 

[0029] In yet a further embodiment of the Invention Jhe client computer includes a timer mechanism for determining 
the response time of the application program as defined by thie time elapsed between. fhe service request and the 
service response In a preferred embodiment the transaction record information for a generated transaction record 
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includes whether me application program euecosef wily responded to the request (l.e , whetharlhe application program 
was available) ^nd the response time of the application program, • 

[0030] in accordance with a related aspect of the Invention, a central repository is provided Tor receiving the generated 
transaction -records from any of the probes Implemented at any of the client computer* in the computer network. 

5 IO031 J A determination is made based upon the probe configuration as to whether a particular transaction record is 
to be forwarded to the central repository, and if so, the transaction record is loaded, vra a database ibadma module 
Into a raw data table in the repository. The data in the raw data table is periodically processed to general© statistics 
which are determined to be of general interest to users of the network. The data required to generate such statistics 

■ is extracted at defined intervale from the raw data table by a statistical processing module which in turn generates the 
10 desired statistical dgta and causes the statistical date to be stored in a statisiics table in the central repository, in a 
preferred embodiment the statistical data may include die maximum, minimum and median response times for an 
application program during a defined service interval as well as a percentage of time that the application was available 
during that interval. 

[0032] I n yet another refuted aspect of the inventfon means are provided for interactively and sequentially displaying 
is a series of data sets on a viewer's computer, The sequence of data sets are .preferably graphs displaying the availability 
and response times for an application program from one or mpre client-based probes in the network over a variable 
period of time such as a month. The data sets comprise data elements corresponding to, for example, the performance 
of an application program at a set ol client-based probes tor one day- of the month snovyn fn the displayed data set, 
' The data elements are dynamically linked to other data sets each having their own Set ofdata elements related to the 
« dynamically linked data elements from the first set and'each of these data elements may be further dynamically linked 
to other such data sets. The dynamic links are preferably capable of finking to data elements in a second data set and 
back to the data elements in the first data- set from the data elements in, the second data set. 

[0033] The dynamically linked data elements are response© to fnieractions from the viewer such as a mouse^frck 
or-voice commands which cause the viewer's computer lo request the relied data sets from the repository The request 

6 causes a eottwarcbased bridge element to retrieve the requested dater from the repository and to provide the data 
sets to the viewer's computer whereat the related data set having the associated data elements is fn turn displayed. 
10034] In an embodiment of the invention, the graphical display may be converted to a tabular representation via a 
viewer interaction wrth the graphical display 

px)3S] In ye? another embodiment, the data elements or the first displayed data sets represent a consolidation of - 
30 each of The associated data elements within the one or mete dynamic linked related dala sets, For example, in a 
preferred embodiment of the invention a data element in the first data set .which represents, for example, the response 
times for a number ol different probes monitoring an application program on different servers fora particular day of a 
designated month, may be dynamicaliy linked toa second data set comprising data elements representing the response 
s times for tfte each one of the set of probes monitoring the applicatrop program on the different servers, for the pamcuJar 
35 clay of the designated month Moreover, the data elements in this second data set may be dynamically linked to further 
data sets havmg further related data elements therein. 

[003GJ In tbfs manner the viewer, by actuating the dynamic Finks, may "drilWown" through the monitoring data from 
a bread view of the application program performance over a period of time on a number of servers, to a very specific 
view of the performance of a particular application program at a particular client (on a particular sever) at a specific 
*o time, and again "drill-up" from thai specific view 10 the same or a different broader view 

Brief Description pf the Drawings . , 

[Up??] The Invention will ngw be described, by way of exarhpje only, with reference tp the accompanying drawings 
*s fn. which* t , \ • ; ' ' > ' , 

FIG. 1 .illustrates* a typical network computer erivirc^rrrern In which the 'present rnvientfon may be implemented; 

RQ 2 depicts a simple, single probe implementation of the present friveniion for monitoring the performance of a 
so ' Lotus Notes application program on a server computer at h client computer and for recording and storing monitored 
performance data for presentation via a graphical user Interface front-end as well as signalling support personnel 
via alerts 1 a prc<ieteirrHned performance threshold is viofeted; ; 

FIG. - 3 more 6pacrficalry depicts a sequence of operauorhe included in the single probe rir^lornentation Including 
55 the provision of an interface for probe configuration information, the interectfon belween the probe code and arc' 

application program on a server computer, the generation and storage of transaction records and the generation 
of alert signals. 
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FIG. 4 includes a 'flow diagram for illustrating the iterative service, request and service response interaction between 
the AMA probe on the chent computer and the application program on the server computer, and the generation, 
and storage of transaction records, ; 

fi. FJG. 5 depicts the storage of a probe-generated transaction record in a central repository as well as the scheduled 

etansticai processing of the transaction- records into .statistical data loaded into the statistics fable in the central 
repository; 

FfG. 6 presents a block diagram illustrating the function of the web server computer in providing, upon request, 
jo applets for the graphical U6er interface lo a web browser on a viewer's compurer and the fulfilment of requests 

, generated by the viewer by interacting wjth the graphicaf Interface on the viewer's computer, the request being 

handled via the software bridge element for accessing the data stored in the central repository on the database 
server computer, 

is FiGs. 7 and 7a illustrate a display spreen for a front-end graphical use r rnfeifacefcf the viewer's computer showing 

scalable measurements of application availability and response time for a Lotus Notes application program running 
on all listed servers for the Poughkeepsie sue for the month of February 1 998, ' 



FIG. 9 depicts trie data Illustrated In FIGs. 7 and 7a in a tabufar rorm which fs dynamically Jmkad thereto, 

' FJG. 9 illustrates availability and response lime data tor each of the Poughkeepsie site servers running the Lotus 
Notes appf/cation program on February £ 1998; 

FIGs - lOttrtd 10a present two versions of scaled graphical displays on the viewer's computer for availablHty and 
3 s .response time data tor February 1998 actuated by a /lewer by implementing the dynamic link in FIG. 9 for server 

CXMIVJL01Q running tine Lotus Notes application program; 

FIGs. 11 and lla present two versions of scaled graphical displays on a viewer's computer for availability end 
response lime data for February 2, 1 99B actuated by the viewer by Implementing the dynamic link in FIGs, 1 0 and 
30 10a for server D01 MUTJO running the Lotus Notes applicalfon progrsm; 

FIG. 1 2 depicts the data illustrated In FIGs. "It and lla In a tabular form which fe dynamically linked thereto; 

FIG r 1 3 presents & flow diagram illustrating the steps undertaken in response to a viewer ^rnptemeniad indication 
& to actuate the dynamic links presented In the foregoing displays fn FtGs, 7-12; 

FIG. 14 d/spfays an inverted treB graph illustrating the inter-relationships of the dynamically l/nked dispfaye Typified 
by those illustrated in FIGs, 7-12; and 

FIG. 15 more particularly illustrates features of the alerting function of the present invention. 
Detailed Description of the Invention 

[0038] The tollowing description will present a preferred embodiment of the, present myentron wherein a system, 
*s method and program product fprmonlrorfng, reportjrigand providing' alerts based upon the response time and session 
availability of a Lotus Notes (Notes is a trademark of. Lotus Development Corporation) application program running on 
- a server computer wheref rom the services of the appiiqatfon program are provided to a cRehi computer system cotipled 
via a distributed computing network to the server computer system fs provided. Notwithstanding the specific nature of 
the ensuing description, it will be readily understood by ihose skilled In the art that such inventive monitoring and 
*v alerting techniques as described heroin may be employed to assess any desired performance characteristics of any 
application running in a distributed computing environment from the vantage point of a network resource (i.e., a client 
of the server) requesting and receiving the services of the application provided from another remote resource (i.e., the 
.server) wiffljn the distributed computing errworwnenL For example; and without limitation, such an nventive system, 
method and program product as described herein may be readily incorporated into a corpora*© intranet or extranet to 
ss assess the ava|I$bility and response times of hypertext markup Janouage (HTML) based applications runnmg on a 
server computer and accessed by a client computer via hypertext transfer protocol (HTTP) over an intranet or over the 
Internet, 

[0039] In order to better appreciare the advantageous features of the present invention, it will be instructive to first 
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consider a typical distributed computing environment in which trie present invention may be implemented. Accacd\nQlfy, 
Fig 1 depicts. a typical distributed computing environment 100 which may be characteristic of the cgmpuung environ- 
ment of a 1 small td mrd-sized enterprise, and whfcb can be expanded upon to include broader networks such as a 
corporate network pr intranet far a large business enterprise or the Internet. In such a distributed computing environment 

5 1 oaii Is Irfcely that there will be one or more networks 101, 1 02 of varyln 9 size, each including a set of server computers 
104a, 104b which may provide services and information to a set of client computers also coupled to the network 103 
(one of the exemplary client computers may execute the monitoring code in accordance with the present invention). 
These smaller networks 101, 102, which may tor example represent focal area networks for a regional office of an 
enterprise, may In turn be coupled to one or more larger networks 103 The larger networks 1 03 waulo* typically couple 

10 . a set pf such smaller networks 101, 102 as weli as other server computers 104c, and correspondingly enable, for 
example, client or server computers on any of the smaJler regional local networks 1 01 , 1 02 to couple to server or client 
computers.on the other -small local network 102, 101 or on the larger network 103. 

[0040] In the course of the ensuing discussion it win be understood that references to server computers correspond 
to a class of computers which are typically stand-alone computer systems which have been adapted (I e , programmed) 
is for one primary purpose; that of providing services to individual fretwork users at client computers. Likewise, a cirent 
computer may be a stand-alone computer system or arfy other'type of data processing system that has been adapted 
tp interact with server computer systems over a network, including without limitation network computers (NCs) Client 
compurer systems generally refer to any computer system adapted for the use of an Individual rather than for Use by 
other computer systems. 

so [0041 J It wfll be rurther understood herein that the exemplary. distributed compulino: structure or network 100 depicted 
in Fig 1 is merely an illustration of a IvpFcaJ distributed computing environment in whrch the present invention may be 
advantageously implemented. A virtually unlimited number of variations ol this same basic computing environment 
including the expansion of the distributed computing environment to the, widely attributed computing environment of 
the Internet will provide a suitable platform for practising Gbe present invention 

26 [0042] Turning now to pur invention in greater detail, reference may be had to Fig, 2 wherein Is illustrated a simplified 
computer network'2p0 including an application monitoring and afertfng (AMA) probe- 201 designed in accdrdance wjfh 
the principals 0/ the present invention. From a cursory inspection of the network 200 it can be seen that the AMA probe 
201 1$ embodied in a client computer (for example computer system 1 0S ipFfg, f) which is coupled to a server computer 
2Q2 The server computer 202 Includes an application program 203. the performance of which will be assessed by the 

30 monitoring and alerting activities of the AMA probe 201 

[0043] ■ fn operation, the- AMA probe 201 establishes a .session with the server computer 202 by requesting the serv- 
ices of the application prpgmm 203 operating thereon. SeGslon establishment is actuated by a service request 210 
sent from the AMA probe 201 over a network link 206 to, the server computer £02 Correspondingly, the server com' 
putefs application program 203 provides a service response 2t1 over a network link 206 back to the requesting AMA 

35 probe £01 r , 

[0044] l,t Is particularly noteworthy that the foregoing sequence of transactions is precisely the same sequence of 
transactions undertaken, by a customer of the computer network 100 seeking the services of the application program 
203 on the server computer 202 at his/her dfent computer 106. In essence, by monitoring an application program and 
providing alerts based upon the aforementioned sequence from the viewpoint of the AMA probe 201, the present 

40 invention achieves a realistic picture, of the performance of the application program 203 from tpa vantage point of a 
customer using the application program over the distributed computing system 100 at 'client computer J 0.6. By imple- 
menting the AMA probe 201 in this manner it le possible to gaiher reaMjme information based upon an ■e^d-user , s ,, 
experience of a client-server based appricatiori program 203 The AMA probe 201 . in accordance with the preferred 
embodiment of the invention, quantifies the availability and the response, time or other.desired performance aspects . 

is of such an application program in relation to pre-defined and dfteh contractually •enforced performance criteria for the 
network '100. Consequently, based upon the results' obtained from such a probe It is- a relatively simple matter to 
eslgbHsh such peWormance criteria for a glven^applJcatton program over a given network and correspondingly to identity 
instances;' wherein an application program on the network fails to meet the. established criteria. Through the facilities 
of the present invention, a network manager may establish and monitor ddherenca to SJ_A objectives. 

£0 [TO4S] Turning to a more detailed consideration of Fig. 2, it is noted that the AMA probe 2tM may receive a number 
of dffferent types of service responses from the server computer 202, For example, if the application program 203 on 
, the server computer 202 properly responds to the service request, the AMA probe 1 201 wjil receive ah indication of a 
successfully completed request i.e., a successful Service response; {rorn'lho sen/or computer 202. Aftdrnaijvoiy if The 
server computer 202 is unavailable to respond to the service request 210, the request will timeout after a predeterminetJ 

6& period and the AMA probe 201, based upon receiving/ back ho response for the time out period, will record that the 
server computer was not available. Thfs can be viewed as an unsuccessful service response £11'. Finajly, if the server 
computer 202 rejects the service request 210 ihe AMA protie will again record The transaction as an unsuccessfuf 
service response 2J1 * A rejected service request 21 0 may correspond to a variety of different situations, such as. 



7 

PAGE 25/58 * RCVD AT 7/2/2004 10:42:58 AM [Eastern Daylight Time] * SVR:USPT0-EFXRF-1/1 * DNlS:8729306 * CSID:202+872+1024 * DURATION (mm-ss):21-22 



FROM WORLDCOM TECHNOLOGY LAW WASH DC (FRI) 07. 02' 04 1 1 : 15/ST. I i ;05/NO. 3562186309 P 26 

EP0957432A2 

wherein the dfem is nan authorized to access the particular served or application program 203 thereon, or wherein the 
application program 203 has been temporarily t^en "ofHrne'' for maintenance purposes or if tins application program 
203 is functioning Improperly for any number of reasons, 

[0046J Whether it ib successfuf or unsuccessful, the service- response 2l 1 .from tfie application program 203 on the 

5 server computer 202 (Including the determination of a no^esporrsa time-out) Is received at the AMA probe 201 , which 
then records the results of the transact bn in a database repository 204. 

[□047] The database repository 204 may be local to the AMA probe on the client computer 100 anoYor remote from 
the probe at another poirrt on the networK 200 coupfed thereto by a network link 207 or in a preferred embedment, the 
invention may include both a local and remote datarepository 20* and data may be stored locally and forwarded either 

io concurrently or subsequently to a ceni raPzed remote repository which collects probe data from a number of probes 
monitoring different applications at different polms on a distributed computing network tOQ. In the preferred embodi- 
ment, the centralized database repository 204 for recording the transaction, records from rnufeipfe probes 201 on the 
network 100, is designed to toe accessible to any user of the distributed computing network 100 and would fdealfy 
provide affront-fend graphieaJ user interface (GUI) 212 such asjan Intranet-based web site accessed via hypertext 

1B transfer protocol (HTTP) and providing a page or pages of hypertext code (i.e. hypertext markup language or HTML 
pages) which would permit anyone wrthin the enterprise to easHy access and analyze the data stored therein. Further 
details of such a centralized reporting mechanism including a graph lbs-based reporting interface wtfi be subsequently 
rJescribed' herein, ^ ■ 

[0046] In a 1 •lurtrrer preferred' embodiment of the present Invention; facilities are provided tor accommodating the 
'establfShmenr of » pet of narrorm^nco enters for Ths? m^aflpfed flp^nr^rfon program £0.1 in sunn n preferred crntgd- 
rment, the AMA prgbe 201 determines vyfieiher any pertinent elements of the completed transaction incfucfina. the 
service request 210 from the^probe and the corresponding service response 211 from tfie application program 203 on 
server computer 202 have exceeded such pre-defined criteria. Trie pro-dofrn&d performance criteria may Include such 
meirics as maKimurn allowable response time, and/or a maximum numbered failed successive attempts to access tho 

6 • services of tho application program (Le. r an indiera of session, availability). 

[OO40J A determination that one of these pre-defined performance crrteria has been violated prompts the AMA probe 
201 to generaie an alert signal 208 which is sent to an alerting mechanism 205, which in turn is designed to inform an 
appropnate support entrty of the violation such thai problem determination and remediation steps may be quickly im- 
plemented. 

30 [0050] To belter Illustrate the foregoing Iran sacf ion sequence we will referto a preferred embodiment of the present 
invention wherein a Lotus Notes application program 203 is included on the server computer 202. The client computer 
100 including ths AMA prbbe 201 further includes confrguratfon facilities for Implementing the function of the probe 
[0051] Referring now to Fig. 3 it can be seen that these configuration facilities include a GUNbased front-end 301 
wtrfch is provWecfto'elfcit information pertaining to the function of fhe probe (.i.e., probe configuration information 302) 
3$ from the party responsible for the implementation of the AMA prope (i r e, from the end-user). In an exemplary smbod- 
fmem, the probe configuration information 302 will include the name of th£ server computer 202 including the application 
program 203 for which monitoring is- desired (i.e., the target seryer name), the network address of the target server 
and the type of application oh ihe larget server to be monitored (rdr example LoUig Moles), this basic set of information 
. isrtecessary to establish tne initial sequence of network communication operations comprising tys oiorementiorted 
*o transaction sequence undertaken by the AMA probe 261 including thB generation ofa service' request from the AMA 
probe 20f brt tftQ' cKehr computer 1 06 to an application program 203 on a server computer 202. 
• [0052] Further items ot probe configuration information 302 which may be elicited irt an embodiment of the present 
invention include access ccrilrol and aythenticatfori rnforVnatlon.ff requrrsd, for accessfrig secured transactions (i.e., 
such information as user idenlffication and password}, as we|Tas Instructions regarding the processing of the information 
4S gathered based upon the service responses 211 of th$ application program 203. 

[0053J The information required for processing the service responses 211 from the application program 203 on the 
' server computer 202 ,may Include, without limitation, a storage .designation, indicatfngithe repository 204 for storing 
information regarding the oornpleled transaction (i.e,, tttetrayis^ctfcvi riecorp^), Asprevrc^sty noted, this roposjfory may 
be local 305 (pine clferrt computer 1 06 and/or a remote pentraJ repository 306 on the network 200 which stores data 
so gathered from multiple probes 20i monitoring muUrplo appfrcatiori programs 203 on multiple server computers 202. in ' 
a preferred embodiment of the invention, storage cperotrons may be undertaken both local 305 to the client computer 
106 Including the AMA probe 201, and remote on the nhtwork 100 at the central repository 306/ and the repository 
designations wfff bo provided for both reposrtory locations 305> 306. . 
tO054] In still a further embodiment of the invention, probe configuration information -302 would be elicited, for deter- 
as , minfng the sampling frequency fpr generating the service requests 210 to the application' program 203 on the server 
computer 202. It wflf be further appreciated that the" AMA probe 201 may bo, rnetructpd to monftor multiple application 
programs 203 aflher on the same or on different server computers 202 In such an multiple monitoring implementation, 
the sampfing frequency may be defined locally for each application to be monitored or globally for a If or for a portion 
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Of an of such applications 203 monnored by the probe 201 On the client computer 106 

[OOGSJ As previously noted, a preferred embodiment of the invention comprises fecihries for generating an aTert signal 
20G for actuating an alerting mechanism 206 signaling the violation of pre-defined performance crrrerla, Accordingly, 
such, an embodiment wfll require trie establishment, as a part otthe probe configuration information 302, ol these pre- 

5 - defined performance criteria, For example, it would be a simple matter to define a maximum glfowabte response time 

for receiving a successful service response from a monitored application program. 203. As will be subsequently de- 
♦ scribed, the AIWA probe &01 generates a tranGaction record including iheduration of the transaction cycle from service 
request to service response Hthis duration exceeds the pre-established threshold, an alert signal 208 will bp- generated 
by ihe A MA probe 201 and forwarded to the alerting mechanism 205. 

w [0056] In an embodiment of the invention wherein it is desired Jo establish an availability threshold for an application 
program 203 as part of the probe configuration information 302 which when exceeded yvW trigger the generation of ah * 
alert signgf 20B, the process may be Implemented by determining a maximum number of successive unsuccessful 
service responses received by the AM A probe 501 from the application program 203 on the server computer 202. 
[0057] A particular configuration of the AMA probe 201 for determining an availability performance criteria for the 

is application program 203 rrjight entail, for example, the establishment of an availability threshold designed In accordance 
with the foregoing description, coupled with configuration information Instructing the probe 201 to immediately, upon 
the receipt of en unsuccessful service response 211, reinitiate the service request 210 until either a successful service 
response 211 is received or the threshold is exceeded and an afert signal 208 is generated. In this manner, it is possible 
to closely relate the generation of an application ava liability-based alen signal 200 with the loss of the availability of a 

zo particular application program 203. depending ol course upon the defined sampling interval 302 for generating the 
initial service request 210- 

[0056] Since any server computer 202 on a distributed computer nafworkilOO will require periodic maintenance which 
often requires that the server computer 202 is not available to provide application services to client computers 106 on 
the network, it would be advantageous to account far such known "service outage intervals" so as not to perform 

6 application monrtonng during these intervals or arteratrvcty to cond/tfoh the results of monitoring done during tho main- 
tenance outage periods by associating ihese results either with aflag or other indication that these results were obtain ad 
during such an outage interval. Moreover, it may simply be the, case ihat the application program SO 3 is not run con^ 
tinuously but only at certain scheduled times.- Accordingly, a furthier embodiment of the Invention would elicit such 
information as the availability schedule for the application 'program .203 as pan of the probe configuration information 

^ 302 >t - ' k 1 

. [0059] Each of thase aforementioned if ems is included in the probe configuration information 302 of a preferred 
.embodiment of the, invention which are collected by the GUI-based AMA probe interface 301 depicted in Fig. 3 and 
further iliusf rated in tabular form in Fig' 3. In accordance with the illustration in Frg 3,- probe configuration information 
302 collected t>y the interface 301 is provided to the executable portion of the AMA probe 303 on the client computer 

8* which in turn functions by generating service requests 210 to tho identified application program 203 on the target server 
202 in accordance with the configuration information 302 provided by the GUI 301. 

[0060] Considering once again our exemplary embodiment wherein a .Lotus Notes application program 203 on a 
server computer 202 is to be monitored by the AMA probe 201 . Once the probe configuration information 302 has been 

- entered into the graphical Interface 30t , the AMA probe executable code 303 resident on the client computer system 
1 0S utilizes an application program interface (API ) 304 for the application program on the server computer, in the same 
manner as, an end-user client seeking the services of the application program 203 over flic network 200 However, the 
frequency "p i access, userkJ, password, etc with which the probe code 303 requests the* service response from the 

. application program interface 304 are dictated by the probe configuration information 302 supplied through rhe graphical ' 

. interface 301 .In thd case of the Lours Notes application -2Q3 the AMA code 303 trtrtrzes the Nates APIs 304 included 
45 - fn Lotus VIM (Vendor Independent Messaging) API TbolWt. 

[0061] In an illustrative embodiment of the Invention including the Lotus Notes-based monitor, the transaction be- 
tween the probe 201 and the application 203 entails a* request from trie probe to the Uatus Notes database server to 
open a Lotus Notes database fife called READMEJM3F, This transaction, while not a common user request lor a Lotus 
Notes database, mail or hub server, is indicative of me availability and response i|me.of the application program In 
50 general. Such a simplistic service request 210 is ideaPfy eurted.for monitoring proposes in the present invention, since 
it is not required to authenticate the requesting session via a password to secure a successful response 2if . Further- 
more, this particular service request 210 doss not necessitate, processor-intensive operations at the server computer 
202. and accordingly tha transaction which re Iteratrv^ly performed over trjo computer network 200 does not materially 
impact the overall performance pf the server computer 202 for other client computers 106 on the networfc 100. It wilt 
ss of course be understood that the choice of the particular transact ton tp be monitored is to be left to the entity admin- 

; islering tho probe and Is not iri anyway to be limited 'by the particular description herein. 
■ [0062] The completion of such a client-server transaction comprising the service request 210 and the service re- 
sponse 211 , culminates in the generation of a transaction 'reeort' 311 which is forwarded via the AMA probe code 303 
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to a storage repository 305, 306' The transection record 911 includes inforrnaiion regarding the rransacr/cA such as 
.whether the application program 203 has successfully responded to the service, request 210, the total duration of the 
transaction cycle from request tp response, fho lime of day of theserVicg request and #ny' other melric which may be 
of interest to the .entity seeking to monitor Ihe particular applfcstipn program' 203/ ■ • , 
5 [0053] In determining the cycle du^ Irtapreferred • 

embodiment of the Invention the timer mechanism 307 may stmpty be a mechanism" which places a time signature on 
the iprtraJ service request £iOfrom the profee^l and another tim is slgnature-on the service reGponse2il attheprdoe 
201 end which records the difference between these tuyo tfme signatures in a transaction record 311 , In the preferred 
embodiment Including trie Lotus Notes monitor, availability and response, time arte the key rrletrlce lor which daia Is 
io included in the stored transact fon> record 3t1 An exemplary t/ansactloh record frorri the AMA probe 201 is Illustrated 
below: ' ' 

. Meas Monitor Target TgtSrv. Srv Monitor 0=^F 

Date Local Time Server. Type Doc ;Niaitie • 

'05/2B/1997' -19:54s40'' "VQ2VB£Qi* "SPM; "SB?" "$&Y" w l m 

TP Ping Notes Dfi Recfuest ■ 

•O.O0DOP0" »1- 281000- *6* 

, . ' . • . . i ' . ■ 

;Jt wiff be observed in the above-listed transaction record that theiparticular transaction recorded a successful service 
response (wherein a>"l" is recorded in the field "G=R f=S) and the response tfmc'wBs 1.2S1000 seconds for lire 
transaction. 

P»e4J In addition to providing transaction records to the repositories 304, 305, an additional feature of the present 
invention provides the reaUlme results of the tmne action back to the relevant fieid? of (the. GUI -based ir>tsrface "^01 . 
In this manner, a user may view the response time and availability mformaf/on corresponding to each transaction orice 
■ fhe AMA probe cods 303 h?s processed Ihe transaction record, if desired, by viewing the GUi-based fields 301 
[0066] As has been previously discussed, the records from' the transactions may be stored locally tn a repository 
. ,305 on the diient computecahdfor remotefy in a centralized repository 306. The instructions for such storage operations 

• are Included in the probe configuration information 302 designated at the graphical inferface'30t fevsl In an alternative 

• errrbpdiment it is possible that the records wilf not be stored in any repository This would be the case, for example, 
whentf n onfy alerting of violations of performance criteria is desired from the probe or wherein only real time transaction 
Information is of interest to the network administrator. Such implementation, choices are a function of the desired ob- 
jectives of the application monitoring project and all are enabled by the present invention. 

fl)066j Referring again 10 Fig, 3 ft win be further appreciated that upon generating the transaction record, the probe 
201 further performs th reshofd compa neon opar3tfans:requrred to 6 eterrnfne whether any of tfje interface -batied (301 ) 
predetermined performance criteria have been violafed. If "rt is determined that one or rriofeof these criteria fiave been 
violated, an alert signal 90S is generated by the probe 303 and forwarded to tfje alerting rnecharfism 205 for Informing 
^SG^vJCe personnel of the violation incident. 

[Q067J Fig.. 4 summarfzes the steps Involved in a processing aj client-server transaction 400 in accordance with the 
present rrrvenibn. The process is [nfnated at step 401 and proceeds to step 402, where the client computer system 
including the AMA probfe software 201 prompts a network-user viaaGUf template 301 or otherwise to enter" the probe 
configuration' fnfofmatcpn 3ti£ to control the function of the' probe code 303. Next instep 4d3, the pibbe configuration 
information & provided |o the executable portion pf the AMA probe code which uses the Information to initiate a sfcrfes 
of service requests 210 in Step 404 xO a monitored application prjogram 203 on a target! server computer system 202, 

• As previously ndted ffte tarcjet server 202 and application program 203 are included in the Information provided to.the . 
AMA probe code 303 ve the template 301 in step 402.. 

[0060] The service requests 210 generated by the probe ejfort service responses 1 which are received by the probe 
' code 303 in stdp 405. Next jrt decision box 406 the code 303 determines whether the service response i3 successf uf. 
As previously described, in the case of succeesf u( service responses, tho probe receives an indication that the service ' 
request was received by the. application program and is being fulfilled. In contrast, an unsuccessful service response, 
may correspond io either no service response from the application' program prior to the expiration of a pre-defined 
time-out period or alternatively to a service response from the. application pfpgram Indicating lhat the service request 
is not being fulfilled, In the event that an unsuccessful service response is received by the probe 303, the probe may 
respond (depending upon (he sat-up of ihe probe via the probe configuration information 302) by Immediately retrying 
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■ the service request A.GA, the retry operation, if ©nabled could edm prise a single or multiple retry attempts which may 
be bounded by either number of retries or a rerry trme pcnod 9s re radicated at decision point 4Q7 Upon exceeding 
the determirted retry interval without elicrtirtg a successful service response, a transaction record for an unsuccessful 

' service response is recorded 410- 
s [0069] In either case, whether the service request produces a successful or unsuccessful service response, a de- 
' termination may be made as to whether any prs-defined thresholds, which have also been defined in the probe con- 
figuratfon information ( p step 402, have been violated ff * » determined that such thresholds have been violated, 
an elerl signal is generated by the probe 4G9 and passed to the alerting mechanism 205. 

[0070] Concurrently.- or subsequent to ttie threshold determination 40B. a transaction record 311 is generated by the 
10 AiyiA probe cade 303 Irr step 410. The transaction record 311 , a3 Illustrated above, includes information pertaining to 
the specific transaction (i.e., the service request and response cycle) that has jU3j completed. The transaction record 
. is nest stored in a local and/or central remote repository 305 and/or 306 in step 411. The cycle pegmning with the 
. initiation of a successive service request ins step 404 is repeated in step 412 if iteration has been instructed and at 

■ the frequency defined by the probe configuration Information. Finally, the process may tie viewed as being bounded 
is by ending block 41 3. 

10071] In accordance with the foregoing description it can be seen that the AMA probe 201- may be implemented to 
generate transaction records 311 which are iteratrvely appended to a repository whrch may be focal 305, or centralized 
. 306. The centralized version of this repository 306 wjl| include a history of application service transaction records 311 
tor each monitored application program 203 on each server compuier 202 being probed in a distributed computrng 
&Q system 100, A further feature of the present invention relates lo a method; system and program product lor providing 
this stored Information to users of the distributed computing environment 1 00. Another feature of the present invention 
• relates to a method, system and program product for processing Jhc alerf3 306 generated by the AMA probe code 303 

and for reporting the alert conditions to support personnel. * 
• [0072] Referring now to Frg 5 we are presented wjtb an overview of the Implementation and organization of the 
25 , centralized data repository 504 used for storing and providing reports for applications service transaction records 311 . 
More specifically, Fig, 6 illustrates the insertion of real-time transaction record data 31*1 from the probe code 303 into 
the centralized data repository 504 and thegeneratfonrof statistical data 50G based upon the inserted real time data SOS. 
[0073] in .operation, a transaction record 311 is gsnerafed by the AMA probe code 303 ( at the conclusion of a trans- 

• ■ action cycle The record is provided to a database loader modu1e'5G2 which inserts the real-time transaction record 
3D data into the mw data table 505 m fh e centralized AMA data repps ifory 504 .Record insertion frdm the database loader 

502 is actuated upon the receipt of a, transaction record 311 from any of the probes 201. runnFnp, on client computers 
106 In the distributed network 100. As such, it can be seen thai the raw data table 505 of the repository 504 includes 
Tear time data provided at approximately the time that the transaction records 311 are generated by the probe code 
303 in addition to any Inherent latency associated with passing euch data .over the network 1 00. 
•55 [0074] 'As a consequence of the application monitoring activities undertaken by the AIWA probes 201 ..there exist 
' identifiable sets of statistics, based upon the rawdaja 505, which are known to be of interest to end usersof the network 
100. These statistic sets include, for example, the percentage of successful service responses 211 per the total number 
. of attempted service requests 21 0 in a determined interval of time. This pre-determined time interval typically coincides 
with fhe SLA between the network administrator© and the network custorner (for example this interval would typically 
40 correspond to a pnme-shrfi work day as defined by the SLA) Alternatively, statistical processing may be actuated upon ' 
the receipt of a defined number of transaction records 311 into the raw data table 505, such that upon receiving 26p 
transaction records irrtofhe table the statistical prooeasmg for the received 2S0 redords will be inrtfetted, Of course, this 
numeric threshold may be further divided into th 6 recaiptof a number of recorns corresoondjng to'the monitoring, of a 
specific application program 203 on a specif to server 202 etc..' \ 
46 . [0075] By processing raw' data 505 within the central repository. 504 at meaningful .intervals, the desired statistical 
sets of data 506 are ma de readily available 10 an end-user who may wish to ascertain some neas ur© of the performance 
of the. applications) 203 on the network 100. From the vantage point of such an enoHiser seeking a report on th« 
performance of applications being monitored, the raw data in table 505 is periodically pre-processed into statistical 
sets pf data 500^ Since the provision of real-lime statistical computation may be a processor-intensive task, this pre- 
fix processing of statistical information provides an efficient reporting mechanfem to the pnd-users of Che network who are 
•querying Ihte information. 

[0076] The pre-prcrfessnng of the statistical information is enabled via the function of the database reporter 507. At 
, pre-definod Intervals the reporter acccssds the data inserted into the raw data cables SOB by the database loader 502 
and processes the information thereby generatrng ihe defined &ets of statistical data which fi then inserts info statistic 
: 55 t > tables 506 for access by end-user queries. ! • 

• • {0077J The database reporter S07 is actuated at intervals cofncidfng with the establishment of a requisite pet of raw 

data for formulating the sets of statistical Informalfon, For example, in a preferred embodiment of the invention, a 
calculation is performed at the conclusion of each business-day prirne-shffi (i:e.. 7 00 Alvj - 6:30 PM) based upon raw 
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data which has been rteratively generated at probes 201 and" inserted by database toader 502'intothe fn raw data labfe 
505 of the centrar repository 504. Alternative fy, as previously rioted, the ovulation may be performed based upon 
receipt of a defined number of transaction records 311 ,at the raw data table 505. ■ 

[007B] Jhts Inserted raw data corresponds to transaction records 311 from AMA proba code 303 which has. been 
* fnonrtonng application programs 203 during this interval At the conclusion df this irrterval;,ii is a simple matter toprcvid© 
•the newfyJnseffedrawdaia to the database reporter 507 which In turn will prv-proces& the data.to provide statistical 
records on the availability of each probed application program during that interval (i.e.., by determining the percentage 
.'of successful service responses recorded fof each application durjng'the interval). Moreover, the statistical information 
may addrtronally include a range of the response lime© recorded -for th a pre-processing Irrfervaj The pre-processed 
10, statistfc^l infomiation is then provided to the statistics table 50p of the central repository 504, In this manner this 
informatlort is 1 calculated onfy once, and may be quickly provided to an end-user querying xhe central repository. '.The 
types of statistics inserted info the statistics tabie.506 witi.be more apparent 9ik subsequent discussions regarding fhc 
front-end GUi's provided to a yiewer of the central repository 504 .a* described with respect to Figs. 7-14 , 
[0079J , In ah exemplary embodiment and as will be subsequently described via reference to fig. 6, an end-user may 
«' receive this stored infonrnatibn over a web^rowser application program by coupling to a, web server program 606 within 
web server cdmputer |S0S which may access'trje statistical information stored fn the central reposftory 504 without the 
need to process the statistical information on demand, 

[0080] fumfngnow to Fig. 6, the funct/on pf the web server cc*ripiiter 508 Is further illustrated. The central reposftory 
504 resides on a database server 601 The end-user seeking to ascertain application program performance data on 
20 the network estab fishes e session <?0& wffh web server program "600 a in'eb brtwsG*" sptftoeHion orocrrprr: ^2 on 
a computer system such as plrent computer system 106 (which, may or 'may .not fnciutfe the AMA probe code 201 ), 
which is capable of coupling to the database server 601 and the web server program 600 in web server computer 509 
In a preferred embodiment; the web server program 600 stores a software package 603, which may be a Java(tm) 
cfass file. The software package 603 is provided upon request to toe ehd-suer computer 106: Upon rece.rpt at the end- 
. & user computer 106 it is fnterpretecf by the web browser 602 to provide the AMA Java applet 604 which in'turn functions 

* to provide a graphical indication of the desired performance date to the end-user over the. web browser 602 (Java is 
a trademark of' Sun Microsystems' Corporation), When an end-user communicates with the vyeb server program 600 
via a uniform resource locator (URL) an authentication process 609 is initiated based upon the fnformatlon provided 
from the web browser program 602 Once authenticated, HTML code is provided 60B'from the web server program 

30 600 to the web browser 602. after which the Java-based software package 603 is provided 606 to the web browser 602. 
[00&1J At tj^ie end-user computer the received Java package 603 is interpreted by the web browser 602 whrch creates 
the AMA Java applet fe04. The AW A Java applet 604 serves as the interface between the end-user and the data stared 

• en repository -504. The AMA Java applet 604 includes a GUI (AfufA QUI 605). The AMA GUI 605 composes a set of 
graphical and tabular objects which are used to assist the end-user in requesting data 609 and analyzing the data 

35 subsequently retrieved 609 from the database repository £04 on database server 601 .' Ae part of the interpreting ol 
the AlWAappiets 604, the session 60S established between the end-user computer 602 and the web server program 
600 is terminated. Upon termination, the web server 508 need not be utilized to perform computations and communi- 
cation required for accessing the data sjtored in the 1 repository 504, accordingry, the web server 506 is available to serve 
other ^nd-usere sesKing establteh a session tnerewtfh, 

40 ! t0082] the end-user computer 106 next generate© requests for data via the AMA GUI 60& frorp the repository 504 
which hasthe effect of -initiating a temporary data fink with the database server 60 1 ! tor recerptof the data stored in the 
repository 504. The AMA bridge 6p6 is a software-based interface mechanism which is logically coupled via a contin- 
uous communication session 61 0 to ihe repository SQ4, The bridge 606 is njven access* to a portion of the repository 
which Is intended to be; accessed by endnusers via web browser 602 running the AMA applets 604, It wJfi be recafled i 

4S that autherTflcatton of the end-user was accompifstied during session establishment 608 between tne web browser 602 
and the web server program 600. As such, there Is no need to authenticate en end-user's access to the repository 504 
through the' bridge 606 The AMA bridge 606 manages' the high-speed bidirectionaf data link 609 between the end- 
user session 602 and W repository 504 on database server 6D1 through the AMA applets 604, in this mannertfie 
data-intensive qraphi'caf presentation materials for graphically representing the probe rhonrtioring results via the AMA 

» GUf 605 are provided as k packet 603 erf software locally implemented 604 at the end-user's web browser 602. The 
comparatively limited data corresponding to the probe monftorfng results stored in repository 504 Is transferred between 
609 the database server 601 and the end-user's computer 106. this data, is processed by the AMA applet 604 for 
display via the AIWA GUI 605. 

[dob3] The temporary user-to^fatabgse data link 609 Is actuated by the user's interaction with the AMA GUI 605 , 
' included fn the AMA applet 604 oh the user's web browser 602. For example, by clicking on templates 605 displayed 
focalfy on the user's web browser 602, the user causes ■his/her computer 602 to request data stored fri the repository 
504 on the database server 60 f The AMA bftdcje software 606 serves an interface for Ihe high-speed transfer of the 
relatively lim/ted data communicated via date link 609 between the end-user web browser 602 and the repository 604 
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on database server 601. The bndge software 606 « implemented as a daemonj^nuafly ^«2lSSiib 

communion session 6Tb tb rhe repertory 504. and In an exemplary embodimer* may physi* 

server 508 or on the database server 601 or on an intermediate computer (noi shown). The bridge daemon 606 provides 

se^orthea^ 

s reouesrs Irorn tM end-users 1hrou S h the GUI 605; and responds wrth the appropriate date from the repository SO*. 
££f X^SE- SSi* (JDBC, the bridge daemon 60S is ^^^^ £^SZ 
rtorv 304 eudi that multiple requests to the repository do not require the creation of multiple database drac^ses. (as 

multiple requests from any number of end-users are managed via a FIFO queue (or °**™f e > tbebnd ge 

>0 daemon 606. Ae such the bndge daemon 606 provides an efficient mechanism for connecting the end-user d.rectly to 

S5m! ^C^hTunderstood that muKipte endure (n) may each access the Web server program 600 at « 
orJen time and may. each be provided with the Java class files. Accordingly, since the session between the end-users 

»5 of end-usere (m where m may be » n) may locally Implement the AMA applet.604 including the AMA GUI 605 and may 
tSXSi*** 609 tb L bridge element.606 The smgle conbnuous communion seasron 610 esteblte Jed 
b«wUn the bridge element and the repository 504 will aerially couple the m end-user computer 1 06 to tne data stored 

t^ ^ Wa^ session 60S w,th the web server program 600 an eraser Mb J^El'KS' 
. templare provided ,n .web server program 600, .which monitored appl loathe) onwhtoh 

ested in The web server program 6O0 recedes .this inlormatiorr and provides 608 the appropnafe Java packet 603 
SqSJd tar creating the appelate AMA applets 604 includ.ng the AMAGU, ~*«"'?^T£riwTS££ 
• The end-user's interaction wnh the AMA GUI 605 executing locally with.rr me web browser 6Q2 on his/her computer 
2B 10 6 actuates data link io the bndgc daemon 60S Which ,s eortifluaify coupled to the repository 504 and wh.cn manages 
the dara axchar*^ thdre between, 11.. 
raoa/l Frorh foregdlng descrptions It wj|. be readily apparent that the database reposrtory 504 r^ VP^V 

■ Uudevoluminouseetsoftransact^ 

of monitored applied programs 203wh.ch havebeen/are present* being monrtored by a plurality of AMA probes 
as S^ecuSfl^n a^p,ur 9 r fty of dent computers 106 on the distributed computing network 100 It w,l, be further appre- 
cTated unat tne useless of thrs stored date S04 is directly related to the facilfty wrth which the data may analyze* 
• A^Xy a further feature of the present Invention comprises graphical display facilities for presennng the siored 
application, monitoring Information 504 to an end-user in an easily comprehensible f^ehion. • 
. Soaaj inpartlouar the present invention provides interactive reportgenerat.cn and graphicalpresentat^n f adlrtates 
enabl na a viewer to. query and obtain graphical.and labular data corresponding to monitored application program 
^e d^ted network 100 at.bolh a high Wye. wherein, for example, the msponse 
«me of multiple se'rvers runnfng an applipatfon program or multiple appl-catton programs is W 0 ***™ 1 **^™* 
pTrfornrancJdaiagarheredover a month or a longer tWe period, and at leveis of ^easing granularity rang^Htottie 
ievel of a display .or table' comprising data corresponding to thfc hourly performance of a V*^*™*™^* 
SD ec,f.c monitored ^plication program. Each of these levels of data in eachof the tables or graphs ,a dynamically 
52 ££5**ZSbto and^he and to previous tables and graphs having a broader; 

the date that is to be analyzed as desired by Ihe viewer. Traversal of these linked labia* and graphs user- 
friendly qtierymg tool for retrieving stored data from the central repository 5tH and for eteplaymg the data at different 

levels of specificity in a manner thane readily userH5omprehensible . 

fO085] Notwithstanding the fact that the ensumg description will ref er to ■ntoracttorrs with the presematlon sysrtenr by 
wavof conSTmouse operation. * will be understood that within the present invents the v,ewer is provided with 
Zabllfty interact with these graphical or tabular representations by any ^compute, ■ intert^e 
. including without imitation po^ devices such aacomputor mouses or frack bails, joysticks, touch screen or lldhl 
' pen implementations or by voice 'recognition interaction w|th' the computer system. The user interaction specifies the 

so sKccessfvW levels of data to be displayed to the yieviter. , . 

I0Q9OI Turning now to Fig: 7 - 1 2 we are presented with en exemplary sequential set df v,ewer ,nteract,ve graphical 
. ' andtabular pVefentations Xhich are implemented ae a portion of the.AMA GUI 606 m a preferred embedment of the 

S5° " The gr^ph 700 in F«. 7 is geqereted by when a user fills pui the template fields illustrated 707 alpha «be 
ss bottom of the graph 700. The.fields 707 include the.AMA features to be displayed (response time and availebrfity « 
' ' the inusfra'ted example), the server (or all servers as in the Example) running the application program for which mon- 
itoring reeufte are to be displayed and the time perkxJ for th6 monitoring (Februaty 1998 in the afample). 
[txraq By filling in these fields, the user causes the AMA GUI 605 to generate a request to the bridge daemon 606 
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, which in fprn'quarjos the repository 504 and returns this information back to the GUI' foe display in graph 700, It will.be 1 

understood as we proceed to describe the features of the fallowing dynamically linked displays in Fig s T - 1 2. that jthe 
'.jnterconnaairig links or active .areas on each tabte or graph, when actuated by the user to traverse the subsequently 

described ssrtes ot graphs and tables, each cause a request fojr data to pass from the. AMA GUI 605 to the b'riqfge 
■ daemon 606 and f urthe r'cause the querying of repository 504 by the bridge daemon 606 and the retu rn of the requested 

data therefrom to the GUI 60^, whfch in turn assembles the returned data via the AMA applet 604 into a display format 

such as shown in the graphs and tables of Fig. 7 - 12. 

[0093] With the foregoing 'descriptions In mind we now turn tp Fig. 7 which illustrates a graph 700 showing the rs : 
sponge lime and- avaflabflijty k for a Lotus Notes mail application on a set of AIX servers for the month of February 1 sjsfl 

10 (Lotus Notes (AIXJ Mail). The X-axis xtf tiia graph 700 corresponds to the days of the month. The Y«axte of the graph 
, Indicates e first scale 701. corresponding to an indicia of percent availability per day of the month of the monitored 
Notes application, a/id a second scale 702 corresponding to an irrdlcla of the response time (in seconds) for the rrron- 
ftored application transaction The ranges for response' time and availability can be scaled up or down a6 desired by 
clicking oh the V .a/rd representations shown for 6ach' scale 702a and 701a respecirvely for example, p ig ,7a 

is . i shows the same graph 700a hqvfng an expanded response time scale 702 by "zooming out - via me V feature of 702a. 
pow] Referring again to fig 7, the graph 700 rncludes bars 703 which correspond to the response time measure- 
ment and data pcHiits 70>} corresponding to the avaNabifrty'measurdrnent. The bar- representations 703 Include a colour-- ■ 
coded mid-point -705 corresponding to the BO* 1 percentile of response times of-the monftored application per day In 
other words, the response rime measurements for the day In que's'tion span p range (for example irom 0.1 seconds to 

20 TO seconds) for the ^pplrcal'on program's response ?11 (o s*£rvtrS3 remits 210 ^ncif r'h<r rn'W-potnl 705 rrpre^pnif> jhn 
i espouse urns measurement" for which halt ol the remaining daily measurements were higher (slower) and for which 
the other half of the rernalnrng dafiy measurements ware lower (faster), In the illustrated example, the bar 703 graph- 
ically display^ the response Umos measured for the day ;in queetfon excluding the fastest 5% end the slowest 5% (i, 
e„ the ranae spans response times in the 6** to'95 1f » percentile or as otherwise defined by ah SLA). The points 704 

& indicate a single data point, for each day corresponding to the percentage of service requests 210 which received a 
successful service response 211 forthe day rn question.. . 

- [0095J Referring to the epeciffo graph 700, for example, iye see that on Feb. fr* the response time indications cor- 
respond to a range of response times from 0. 1 seconds up, to and presumably beyond 4.0 seconds and a 50 th percentile 
falling around'O 1 seconds This indicates that most of the r.esponGe times on Feb. 2, 1998 were clustered in fhearea 

30 of tenths of a. second Likewise'on Feb. 2 nd the graph 700 indicates that appfir^tion availabifity ywas around 96%. 
[0096J in accordance with the foregoing it will be noted that thS graph 700 includes r hot points" (704 tor exaYnple) 
or ^active areas'.which are Interactive portions ot the graph. These hot points are hyperlinks^ or otherwise interactively 
connected po related graphs and tables which permit the viewer lo dynamically examine' a particular point of Interest 
.on the graph 70D in greater detail. For* example, If a viewer were lo perform a rpouse click after placing hisrfier mouse 

& " pointer on the background area 708 of the graph (l,e. , nor on an area showing data for a partjcuFar day, which will be 
f ' ' subsequently addressed), the viewer would, be initiating a request for the data corresponding to a tabu la representation 
• pf the data Illustrated in graph 700 and woufd correspondingly ne presented with the tabfe 000 illustrated In Fig, B. 
Thus, it will be urrdeVsfood that the background 703 of the graph' 700 Is an Interactive hot point. 
[0097] Table 800 shows a tabular form of the data used to create the* graph 700 which ts : useful in that it provides a 
mc^epr^cfseTeadingolda^^rna^poTTdlng.to a panlcu|ardayQ01. To illustrate we can etemine the data for Feb 2 nd . 
Prom the table 800. we cap now see that the fastest response tirhe 802 was* actually 0 071' seconds and significantly 
.that the slowest response time 803 wae 14,062 seconds (the graphical represerTtatibri 700 is'bounded at 4.0 seconds 
but could be re-scaled uslnig the aforementioned ecalfpg feature 702a as illustrated in table 700a Showing response 
time irt the range' of 14 seconds for Feb. 2 nd . Ao^(tiohally r ;the availability dafa per day 804 and mid-point response 

45 ' time B05 per day is Beted jn tabular form. A rhouee-cflcK on the table Boo dyrramicaify returns jhe viewer 10 table 7bo. 

i [0096J If a viewer Wished to discern at wnich server and at whaftlrne of daytfieelow T4.062 second response time 
illustratejd on the on the graph 700, 700a an0 table S0p occurred* they would place la rhduse pointer on the bjar 70S or 
"row B0 1 repreSBrrtinglPiatday, and by cJIcking on hrs/her .mouse, the AMA GUI wflf dynamically query the repository 
•504, retrieve the releVBrit data, and present the vfewer with tablq 90O shown In Fig. 9* :. t 

so [0093J Tabie,900 IHustraies avalfablllty and response, time staifstics ror each server that is represented on graph 700 
^or'thedByof'interestfl.e., Feb 2, 199S) Each server is represented by a hypertinked or otherwiseoVnamlcally related 
bcrtton 90 1 (hot' point) on the feft porijon of table 900' Thetablo comprises columns represcntirlg avarfabflity percentages 
for the day 902, as well as the 5% (903) and 95% (004) arid mrd^polnt (905) response times for the day 

, ' (Oiooj By Illustrating the etatfetteal performailce of each server In table 900 tt is now possible to' easily ttstermfne 

sb which server of seryers.exh/bied poor'response time on the day in question. These .servers are the machines respon- 
sible; for causing the graphical! representation °^ P 0 ^ r ©sp^nso lihie pn graph 7QQ which is a composite of the servers 
shown In the table ^00. Of course, it win be understood that many of the 95% response times for each of the Individually 
l/Sted servers will nor be displayed in the 95% response time for the combined server display on graph 700, 
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[0101 J This exclusion, It will be understood, is mererty a detailed implementation -choree, howevar, it was Included in 
the preferred embodiment due to the fact trial it was discovered that the Inclusion of these outlying data points 
response' times) skewed the graphrcal representation of the majomy of the monitoring data for the period in question 
Ag such, by excluding these outlying poinla.it was found that, the displays more accurately represented the typical 
s performance of the monitored application programs 

[0102] Via reference lo table 900, we can see that server DOTMLpiO eKhribited a 6.649 second response time tor its 
95% response on Feb 2nd, By clicking on the burton 901 corresponding to this server we are* presented with graph 
1000 as shown iq Fig 10. 

0O1O3] Graph 1000 illustrates, in a similar rashton to that described for graph 700. the performance (I e , availability 
10 and response ilme) of server DO 1ML010 ServerVesponse time 7 002 and availability 1001 is charted for each day 1 003 
of the month of February 1998. 

[0104] In a similar fashion as in graph 700, the bars 1 004 represent the response times of the rnonitpred application 
pef day hov/ever, in this presentation, (he data is depicted only lor server D01IWU510, As m graph 700, the coloured 
hash-mark 1006 correspbnding to the mid-point of the S%^93% recorded responses for the day. The data points 1006 

ts correspond- Lo the availability readings for jhe application program per day. Since we'know rbal server D01 ML01 0 had 
a 95% response, time of 5;64Q seconds, the reading exceeds the upper bounds of graph 1000, however in graph loooa 
in Fig 10a The response time boundary has been expanded to show ihe 5,649 response time for this server on Feb 
2, ,1998. t 
[DioSj jf a viewer wished to examine this data in tabular form, a mouse^cllck (or other such viewer-Based interaction) 

£0 on ihe background area would reveal a tabular representational this data identical to table 800, however, the table 
would only nepresent the data in table 1000 which corresponds to server P01 ML01 0. Since ihis table is virtually identical 
to table BOO It is not necessary to illustrate this representation, however it Is sfgnjficant io noite that each graphical 
representation is dynamically linked to a table which more Qpj&cKlcally illustrates the data underlying the graphical 
representation. 

as . [0106] Referring again to Fig. 10, if a viewer wished to examine a graph of the hourly performance of server 
DP1ML010 for Feb. 2, 19&8. e/he would place a pointer on the bar 1004 corresponding to that dale and by mouse- 
cteking would prompt the dynamic generation of graph 1100 ehpwn In Fig. 11 

: [0107J .Graph.noo is identical in format to graph 700 and graph T000, .however graph 11 00 depicts availability 1101 
1 and response time 1 102 for server Q01ML010 on en hourly basis 1103 on the date Feb, 2, 1993. The same indicia 
, 30 1 1QA 1105 and 1106 are used for the response times and availability indicators, but on this graph 1100 the bars now • 
show maximum, mld-pofnt and the minimum values. 

[010S] From this graphical illustration 1100 the viewer can determine at which timers) of day the server exhibited 
poor response-time performance Accordingly, by examining graphs 100 for Feb 2P d for server DOl ML010 we can see 
that during the hours of 10 A.M ,11 AM. and 3 P.M, the response times appeared to be exceptionally slow. However, 

96 since graph 1t00 isbpundpd for response times at 4 0 seconds the viewer would push the V ft .button associated with 
the response time scale 1102a and would be presented with graph 11 00a in Fig. Ilawherain it can be seen that the 
response time for the hour of 1 0 A.M was over 27 seconds, the response lime tor the hour of 11 A.M, was around 25 
seconds and for the hour of 0 PM. the response time was approximately 6 seconds. 
\ [0109J If the viewer wished to see the details for this graph -11 00 he/she would click anywhere on the graph and be 

40 presented with table 1 200 as shown in Fig, 1 2 which in turn illustrates a tabular presentation of the performance data 
comprising graph iiop From this table ft can be seen that the response time for pOrrVlLOIQ'runhmg ^ e monitored 
Lofus.Notes (AJX.-based)/nai| application was actually q worst-^case 73.281 seconds dicing the 10 o'clock A,M. hour; 
{0110] Fig, 13 represents an overview of the display and report generation facilities prw 
- In general, the invention provides a mechanism for interacting Iwith jabular or graphic' deplay representations of data 

4 s . from repository* S04> l.n step 130 T the user requests the retrieval and. display of a first set of .data (i e , the availability 
and .response tirrie data fox Lotus Notes (AIX) malt application for fh« montrroj February for all servers serving the 
Poughkeepsia, NY office tocatlon (see Fig. 7)), In step ! 302 the GUI 603 forwards the request to the bridge daemon 
606 which fn turn Queries the repository 504 and then. returns* (he retrieved data to the. GUf which then displays the ' 
requested data in step 1303. The user interacts wfth designated hot points on the display in step 1304 which rn turn 

SO initiates a riequest, for a second sBt of data related to the data .shown and interacted wfth on the first display Next in 
step 1 305 the GU I 605 again passes (he request to the AMA bridge daemon 606 which queries the repository 504 for 
the requestec" related data, the data is provided via the bridge to the GUI sos i3os which then budds the dfepley of 
the second eel of related data based upon the data returned frpm the repository in step 1 306. k 
[Olll] In Frg. AA which can beread In conjunction wfth Fig- 13 it can bo seen that the Into/relation of the successive 

55 displays described above can be viewed as an inverted tree grt?ph 1 400. Starting at block 1401 a viewer requests via 
a menu (or otherwise) on his computer system the display of a data set including, application program monrtonng-data 
as indicated in block 1402. It will be noted that block 1402 includes both a graphical representation of the monitoring 
data set illustratively represented by bar graph 1402a and a tabufaf representation of the monitoring data set shown 
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ae tabre .1 402b. The table and graph are dynamically linked to on© another by link 1 ^02c such that' a viewer may jump 
between s tabular drapfay of the data set and a graphical display of the data set by cocking op (or otherwise interfacing 
with) an active display area on the viewer's computer system. • '[ , 

,(pl1 2] ' vVitbfn the. data eet'deplcted In table 1 402b or graph 1^2a are date elements represented as A and 6. Each ' 
' s • 'of these- data elements In both the table and graph may be Implemented aft me afprenientioned active^ areas or hot- 
spot such that they may be fndfcated vja a mouse click orDther viewer interface technique. In response to the viewer's 
indication, Ihe dynamic linking actlvrties a3 depfeted.ln Fig. 13 are Implemented to provide the display of a second data ■ 
set including associated data efeiments. For example, if the viewer we're to indicate data' element A within tabfe t402b 
or graph 1402a the sequence Nluetrated in Fig 1 3 would be Initialed for dynamic link 1 403a to subsequently display 
to, the tabfe and/or graphic dispfay represented by block 1 404. 
, [0113] In block 14043 graphic representation 1404a and a tabular representation f4d4b are 6hownfpr the displayed 
second data sef.'Xhe second data set includes data elsrnertts Aj / A2 and A 3 which are associated to the data element 
Arn the deta set ehown 5n graph 1 402a or table 1 D4£b Each of these associated elements in a preferred embodiment 
represents a component of the data element A, For example, in an embodiment wherein the data element A represent© 
| 1$ the range of fespcrise times recorded for a given day for a Lotus relates application program response to three diff ererrt 
probes (I.e., probe 1 r pnobe2 and probe 3), the data set shown in 1404a and 140,4b rncludes the range of response 
'lime recorded at each probe for that given day, such that A, represents response dat3 for probe 1 on the given djaiy; 
' . represents the responses received at probe Z and A3 represents ihe responses at probe 3 for the given day H wlfl 
'Of course be understood thatgraph 1404a and table 1 404b are dynamically linked to each'other Via i 404c and can be 
20 lopaled in a manner similar ,lo, I^sl described fnr ibr cW.h ? nd 140?b v'ei irrk M0?c M w|fl fiThor h^ 

understooo that eaph daja elemem shown m dai& sei l402'(Le ,;a and B) may be finked 1 403a and 1403b to further 
repres^ntaTrohs as has been described for data element A. * ' 

JDIt 4] Each of the data elements in the, cteta set sbownln 1,404a and 1404b may be further dynarnlcatfy linked via 
r links 1406 10 further deta sets (not shown) which fn tunf include date elements which represent components of the 
. tfgta ©foments In (he d^ta set 1404a and 1404b (i v ©„ the data elements Aj, A2 and A 3 ). 

[011 5] It wiH. be appreciated from the foregoing exemplary embodirnerrt, that the AMA QUI in combination with the 

bridge 606 and repository 504 enable an end-user to quickly anfcf efficient/ analyze voluminous data records, fn the 

foregofngsimplfftedexarnplg a viewer was permitted to "dnrt-down* from an oyerv/ewof server performance to localized 

a response time aberration to a specific server at. a specie rime' of day 
so,- . [01161 tt will be further appreciated that the foregoing techniques may be coupled with available data corresponding 

to server specific performance, such as data presided by J6M Netfrnity or other euch' products fo further refine the 
, , : problem determination process. The granularity ol this determination process is limited only by the'amount and types 

of network performance measurements gathered for a given network and by the limitations of data mining and analysis 

tools for correlating this collected information. 
& - [0117J A further inventive feature of the present Invention entails the technique? utilized for providing alerts to service 

personnel upon the determination that any of the defined performance criteria have been violated. 

[0115} As previously described, (he AMA probe 201 may be provided with probe configuration jnfonmat/on 202, in* 

eluding- threshold Inforrnafion such as maximum response time or minimum applrcatron ayailalajirty These criteria are 

monitored by tfie AMA probe code 303 and when a violation Is detected an alert signet 2Q& Is generated by the probo 
*Q for informing an alerting mechanism 2DS of the violation. The alerting mechanism 205 may fn turn function signaling 

the violation to a: Support person, or otherwise actuating a problem remediation response. 

[0119] Fig.:'l5 illustrates ari exemplary Wheftatnreshold 
defined as part of the probe configuration infoimatibn 302 has been violated as deterrrtinep* by the AMA probe code 
303, an alert signal 30fl is slant to the alerting mechanism 20p which is ilktetrated \t\ the preferred embodiment as a 

*s . server computer .1 501 running the IBM fvieiyiew (Rj software appffcarton program (h erelnaf ter the NetView server). In 
tire preferred embodiment the threshold violation eausBs.the AMA probe code to genera J£ a software Indication known 
as a trap 308. fn(s irap Indication |b deflrtod in accordance wfth the transmission control prptocoWntemet : prot0doi . 
(TCp/JP); simple network messaging protocol (SNMP) configuration for dJenl-server network b3se,t| communication. ■ 
.This trap. indication fncludes information about the server computer^S and applfcatlon program 203 therein which rs 

60 ; in violation, arid the .type of violation that has been. recorded. The' aforemertioried spftware triap is well^cnovifn to fhdse 
having skill ih the art and aa sudr needs no detailed explanation. It will be further understood that whHe the present 
rnventlon implernehtflr a software trap to signal the occurrence Of' a violation, other rnechantems such as e-matl r or 
' paging^ pop^up screens or other notifksatlpn methodologies may be utilized as well. 

[0120] Once the trap'SOS is received at the NetView server 1501 it fe appended to a .repository trapd^log l502wlthjn • , 
ss tfie.geirver. The repositdry. 1502 rs in turn scanned at pre-defined intervaJs by another server 1503 (illudfrated as the 
fBiy? Global Sery/ces iboordinator (GSC) server). - 

[01 ^1 J The GSC server 1505 compares any ne* entries in the trapd,tog 1 502 with a set of tables 1S04 within (he 
GSC server These tables 1504 Include information related to the application type, server (ocation violation type and 
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the service person who is to he informed of the violation, how to inform That person {t,B , e-mail, paging, etc, ) which 
may be based upoo such Actors as ttis crttfcality of the violation and the urns of day 

0J122] II theGSC server is able to match the server, application andykilationtypefrorrrtirapd bg 1 502 with an entry 
In its tables 1 504, ar( alert signal 1505 is generated rn accordance with the specified modality 1 506 CI e., pager, e-mair 
etc. ) to the indicated party \ 

[01231 tf the AM A probe code 303 subsequently determines, that a violated inreehofd has return to an acceptable 
revel, further facilities may be provided [or cancel ling the alert. In Such an embodiment, the cancellation would .follow 
the same sequence as the original violation Indication wherein a new software trap 30B would oo generated, this time 
' indicating that the violation. haa been resolved The trap would be stored In trapd,1og 1502 and scanned by the GSC 
server 1503 whose tables 1504 would indicate that the' atari should be cancelled Which in turn would either stop the 
alert signal 1505 pnor to transmission 15Q6 or alternatively transmit 1^06 a message 1 50 5f cancelling the prior alert. 

Claims . J 

1 . A method for'moniiorfng aod recording, at a client computer, information related *q the performance of appllcat ran 
'services by an application program, the method being for uee- in a coirnputer network havfng a server computer, 
couplet to a client computer, the server computer providing application services to the client compuiQr over the 
network via an application program on the 'server computer, the method comprising thesteps of. 

A. establishing a set of parameters tor use by the clrent computer for recording the performance of said ap- 
plication services by sad application program, wherein said set of parameters may include the definition of 
an interval for ffceratively assessing the performance of the application program: 

2£ a sending a service request from Xhc client computer so the server computer, said service request requesting 

the performance of said application .services by the application program baesd upon the established set of 
parameters; 

C receiving a service response from the server computer at the client computer and Generating a transaction 
so • record at the client computer based upon the recerved service response, said generated transaction record 

including the information related to the performance of said application services by said application program, 
and 



15 



ZD 



35 



D. repeating steps B - C as required in Bccordance'wrth the defined interval of Iteration. 

2. A method as claimed in claim 1 wherein the set of parameters further Includes the information required to send 
the service requests to the application progriam at the server computer. 

3. A method as clalmec! jn claim 1 wherein the set of parameters Includes the frequency at which the service requests 
aq are to be sent- 

4, A method as claimed In claim i wherein the generated transaction record includes an indication of the duration of 
' . the period' from tbe sehdlng of the service request to the receiving of the service response, . 

48 s. a method a© claimed in claim 1 wherem the transaction record includes an. .mdfcalfcjn of whether the service re* 
, sponee was successful or unsuccessful and wherein the' set of parameters Include a maximum duration foV the 
period from the sending of the service request to ihe receiving of the service response. 

5, A method as claimed in claim 5 wherein if said maximum duration Is exceeded the servrce request is re-sen! from 
eo the client computer to the server computer. , 

7. A method aS claimed in claim 6' wherein the operation of re-sending the service request may be repeated if the 
maximum durations exceeded afierthe frret re-sending ozonation and wherem the sea of parameters further include 
a limit oh sa*d ^sending operation said limit based upon the duration of -the repeated ro-eendlng operations or 
on' the number of time's the re^sendmg operation is .repeated. ' 

8. A method as claimed en claim 7 wherein If said limit is exceeded the servrce response is recorded as unsuccessful. 
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9. A meihod'asciatmed' ift claim S.wnerein If ths application program fails to provide application services fo response 
(o the service request, the service response is recorded ae unsuccessful. 

to, A .method as ciaimeo' in claim 1 wherein.the* eat ofparameters further Include a schedule corresponding to times 
s ' when the application program will .be available to respond lo top service? requests. 

11. A method as claimed In <claim 10 wherein the schedule- te usBd to enable and disable the sending of the service 
requests or wherein the generated transaction record Includes an indication of whether the' application program 
was available in accordance with the schedule ; 

, ,12, A method as daimad In claim 1 wherein rhese,t of parameters ind ode a set of thresholds related to the performance 
• of the application service^ and wherein the method further iacludea the steps of J 

analyzing the.' generated transaction record to determine if any of the thresholds In the set of thresholds has 
fff been exceeded by the response to the transaction request; and 

: sending an alert signal to an alerting mechanism rt is determined that any of the thresholds in the set of 
thresholds has been exceeded. 

13* A method as claimed in claim 1 wherein the set of parameters .for use by the client computer for recording the 
zo ' performance of said appffceUon s«rv<?os? by saftJ wFpf/calioh program p r c proved Vfa 3 user interne rrc^r a us?f 
of the client computer tp the client computer and wherein information nelated to the received servjee responses 
and generated transaction records are provided from the client computer lo the user interface for vtewhig by said 
user. ' • , , , ; ' 

& 14. >V> apparatus for monrtorihg and recoroTng at a client computer. Information related td the performance of appli- 
cation Gervfcas by. an applicator? program, the apparatus being for use in a .computer network having a server 
computer coupled to a client computer, Vie server computer providing application services to the client computer 
oyer the network via an application program on the server computer, the apparatus comprising; 

so means for establishing a set of parameters for use by the, client computer for.rfceofldtng the performance of 

said application services by said application program, wherein said set of pararhetersmay mcfude the definition 
of an interval for fteratively assessing the performance of the application program; 

k • ' 

means for sending a service request from the client computer to the server computer, said service request 

36 requesting the performance of said application sen/ices by the application program based upon the established 

set of parameters 

means for receiving a service response frdm the server .computer at the client computer and means for gen- 
erating a transaction record at trie Client computer based upon the received service response, said generated . 
*o transaction reoorcl including the information related 15 the performance of s&jd application services by said 

, application program, : ; 

15, A .program storage 1 device readable by a diktat processing apparatus and tangbiy embodying a program of In- 
structions executable by the digital processing apparatus to perform methgd steps for monitoring and recording 
at said client computer Jnfbrrration related to the performance of said application sen/Ices by said application 
program, Jhe program storage device Rising for use In" a computer network haying a server computer cqupled to a 
client computer, the server computer providing appllcatfon services to me client compuier over the network via an 1 . 
application program on the served computer/ trte method comprising the steps of: 

&> A establishing a set pf parameters for use jby the client computer for recording the performance of safd ap- 

pljcattert services by said application program/ wherein said set of parameters may Include the definition oi 
an interval for fteratively assessing the perfoifnarice of the, application program, 



ss 



B, seeding a service request from the client computer toithe server corrtputer, said service request requesting 
the performance of said application services by the appllcatfon program based upon the established set of 
parameters; , • 

C. receiving a service response from the server computer af the client computer and generaling a transaction 
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r^ord at the client computer based upon the received service response, sard generated transaction record 
SS£ E !rSS£i ,o ^perfon^nce of s^d ^ncatfan ^ by e*id apphcflhon program; 
and , 
D, repeating Gteps B - C as required rn accordance wrtrUne defined interval alteration 
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